diff --git a/templates/gokapi/.felhom.yml b/templates/gokapi/.felhom.yml
index 8491b0a..23b34dc 100644
--- a/templates/gokapi/.felhom.yml
+++ b/templates/gokapi/.felhom.yml
@@ -32,6 +32,13 @@ deploy_fields:
     locked_after_deploy: true
     description: "Az alkalmazás aldomainje"
 
+  - env_var: GOKAPI_PASSWORD
+    label: "Admin jelszó"
+    type: password
+    generate: "password:24"
+    locked_after_deploy: true
+    description: "A Gokapi admin felhasználó (admin) jelszava — ezzel tudsz belépni a kezelőfelületre"
+
 # --- App info (info page content) ---
 app_info:
   tagline: "Ideiglenes fájlmegosztás lejáró linkekkel"
diff --git a/templates/gokapi/docker-compose.yml b/templates/gokapi/docker-compose.yml
index ad2f9d7..595884b 100644
--- a/templates/gokapi/docker-compose.yml
+++ b/templates/gokapi/docker-compose.yml
@@ -1,10 +1,15 @@
 # Gokapi - Ideiglenes fájlmegosztás lejáró linkekkel
 # Domain: ${SUBDOMAIN}.${DOMAIN}
-# Database: None (file-based)
+# Database: SQLite (file-based)
 # RAM: ~30M (mem_limit: 128M) | Pi-compatible: Yes
 #
-# Environment variables:
-#   DOMAIN          - Your domain (e.g., demo-felhom.eu)
+# Headless setup (Gokapi v1.9.6 has NO env-var setup): Gokapi otherwise serves a public "maintenance
+# mode" page with an OPEN /setup wizard until someone completes it (unauthenticated admin-takeover risk).
+# The entrypoint below seeds a config.json on first boot (admin user, this app's public URL, local
+# storage, no encryption so it restarts without a prompt) with the password/salts cleared, then runs the
+# documented `--deployment-password` one-shot to set the felhom-generated admin password BEFORE the
+# server starts serving — so the admin account is claimed at first boot and /setup is never exposed.
+# The seed config is pinned to Gokapi v1.9.6 (ConfigVersion 21); re-capture it if the image is bumped.
 
 services:
   gokapi:
@@ -13,6 +18,17 @@ services:
     restart: unless-stopped
     environment:
       - TZ=Europe/Budapest
+      - GOKAPI_PASSWORD=${GOKAPI_PASSWORD}
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+        if [ ! -f /app/config/config.json ]; then
+          echo "[felhom] first boot — seeding Gokapi config and claiming admin account"
+          printf '%s' '{"Authentication":{"Method":0,"SaltAdmin":"","SaltFiles":"","Username":"admin","Password":"","HeaderKey":"","OauthProvider":"","OAuthClientId":"","OAuthClientSecret":"","OauthUserScope":"","OauthGroupScope":"","OAuthRecheckInterval":12,"HeaderUsers":null,"OAuthGroups":[],"OauthUsers":[]},"Port":":53842","ServerUrl":"https://${SUBDOMAIN}.${DOMAIN}/","RedirectUrl":"https://github.com/Forceu/Gokapi/","PublicName":"Gokapi","DataDir":"data","DatabaseUrl":"sqlite://./data/gokapi.sqlite","ConfigVersion":21,"LengthId":15,"MaxFileSizeMB":102400,"MaxMemory":50,"ChunkSize":45,"MaxParallelUploads":4,"Encryption":{"Level":0,"Cipher":null,"Salt":"","Checksum":"","ChecksumSalt":""},"UseSsl":false,"PicturesAlwaysLocal":false,"SaveIp":false,"IncludeFilename":false}' > /app/config/config.json
+          /app/run.sh --deployment-password "$${GOKAPI_PASSWORD}"
+        fi
+        exec /app/run.sh
     volumes:
       - gokapi_data:/app/data
       - gokapi_config:/app/config